Syscall API: mquery()

• TOCTOU: mquery() doesn't actually reserve the address-space: what happens if another thread calls mmap() and takes a spot that ld.so was going to use?

• "Boom"

• O_CREAT : O_EXCL :: MAP_FIXED : ???

  • __MAP_NOREPLACE

• ld.so still does initial probing with mquery()

  • tests showed that probe failures happened often enough to make that more efficient